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(57) Abstract 

A control circuit for controlling a combined emergency shutdown and process protection (safety) system, especially on board platforms 
and vessels. There are two separate signal generators which, each by means of a control line (10, 17) of its own, can give release or control 
signals for operating a control valve (21) for the supply of hydraulic or pneumatic pressure medium for coupliog a nutin valve (23) by 
means of an actuator (22). In oider to. tiiat one of the two control signal chcuits should be capable of being operated independently on the 
operating condition and possible error conditions in the other, the control circuit comprises at least two separate connection branches (U, 
18) for coupUng to a common control line (12) to the control valve (21). The other of the two separate connection branches (18) includes 
an activating member (20), such as a relay, for a switch (14) adapted to connect tiie first connection branch (11) to tiie outgoing control 
line (12). An input signal on die first connection branch is coupled as an ouq>ut signal to the control line (12) when a voltage is forced on 
the activating member (20). 
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CONTROL CIRCUIT 

The invention relates to a control circuit for controlling a 
hydraulically or pneuMtically activated valve in a process 
system, and which comes within the Norwegian Petroleum 
Directorate's "Regulations for security and communication 
systems on devices in the petroleum acticity" or corresponding 
regulations. Such a control circuit is described in the 
preamble of claim 1. 

The Norwegian Petroleum Directorate (NPD) has prepared 
security rules for systems to be included in the petroleum 
activity, in regulations concerning "Security and communication 
systems on devices in the petroleum activity", laid down on 
February 7th, 1992, paragraph 18, it is i. a. required that 
"Devices having equipment containing hydrocarbons must have an 
emergency shutdown system. The system should have a high 
reliability." It is further stated that "components included in 
the system have to be independent on and, additionally, to 
other systems. The emergency shutdown system may additionally 
be used as a process safety valve. The system should not to be 
influenced negatively through errors in other systems." It 
appears from this and other parts of the regulations that 
signals for emergency shutdown and process protection must 
proceed to the local control circuit independent on each other. 
Nevertheless, the two systems may use the same actuator, 
usually a hydraulic or pneumatic cylinder, which e.g. rotates a 
ball valve when the product flow has to be shut down. 
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Therefore, the two systems must meet, and this should take 
place in a way that secures that no errors in the part of the 
system belonging to the process safety system can have 
negative consequences for the reliability of the emergency 
shutdown system. 

In the control circuit where the electrical signal is 
converted into hydraulic or pneumatic pressure, it is 
usual that separate hydraulic or pneumatic valves are 
mounted for the emergency shutdown system, other valves 
being mounted for the process safety system. Therefore, 
the two signals meet in the hydraulic or pneumatic part of 
the system, not in the electrical part. Such combined 
control circuits are well known, and there exist numerous 
designs thereof in use on oil platforms and in process 
systems on shore. 

However, existing control citcuits are burdened with 
substantial disadvantages. They comprise many components, 
causing a significant need for maintenance. Additionally, 
they are designed such that the two signals do not reach 
the actuator, independent on each other. This is a 
consequence of a hardly known problem linked to the 
hydraulic or pneumatic control valves: When a valve 
switches from one condition to another, the connection 
between some gates in the valve is opened, simultaneously 
as other connections are broken. This happens in a sequence 
determined by the way the valve is constructed. In some 
valves, all valve gates are briefly short-circuited in 
the switching moment. Other control valves close all 
gates when they switch. There also exist valves which open 
some gates and close others while they are in the process 
of switching. What kind of error condition that might occur 
if the control valve get stuck while it is in the process of 
switching, depends on how it is constructed. In this 
connection, it is of interest that all known hydraulic and 
pneumatic valves pass through intermediate conditions while 
switching. Therefore, contrary to what one previously has 
believed, one can not carry out security studies of control 
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circuits through studying the hydraulics symbol applying to 
the control valve while it is in a completely switched 
position, analyzing the error possibilities on the basis 
thereof. When analyses are conducted correctly, one sees that 
higher reliability is not achieved through the use of more 
control valves than when using only one. 

The main object of the invention is to provide a control 
circuit acting combinedly on emergency shutdown and process 
safety, and which may be made simpler and cheaper and, thus, 
more maintenance-friendly and reliable than Jcnown control 
circuits. The emergency shutdown system must act entirely 
independent on the process safety system, independent on 
what kind of hydraulic or pneumatic valve being used. 

According to the invention, this is achieved through 
designing the control system as defined in the characterizing 
clause of claim 1. This means that the emergency shutdown and 
process safety system are integrated within a junction box 
having relays, semiconductor elements or the like, so that 
one electrical signal only is transferred further to the 
hydraulic or pneumatic part of the system. The hydraulic or 
pneumatic control valve is electrically operated and has, 
preferably, spring return. When the solenoid current is 
turned off the valve returns to the safe position, such that 
the actuator closes. By using the combined control circuit 
for the emergency shutdown and prosess safety system 
according to the invention, a simpler, cheaper, more 
maintenance-friendly and reliable panel is achieved. 
The Norwegian Petroleum Directorate's reijuirement that 
emergency shutdown systems must be completely independent 
on the process safety systems, is fully satisfied for any 
type of hydraulic or pneumatic valve. 

in the following, the invention is further described with 
reference to the drawing, in which the single figure shows 
a schematic circuit diagram for a control circuit designed 
in accordance with the invention. 
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A combined control circuit is shown in the figure, A 
possible emergency shutdown signal is conducted in on a 
first control line 10 from an external circuit, not shown, 
for emergency shutdown, and is conducted through the first 
circuit branch 11 out on a common signal line 12. Between the 
emergency control line 10 and the signal line 12, a push 
button switch 13 and a relay-controlled switch 14 exist, 
placed in series between input and output of the circuit 
branch 11 • Parallel to the push button switch 13, a 
relay-controlled switch 15 is placed, the coil 16 thereof is 
connected to the circuit branch 11 between the push button 
switch 13 and the relay switch 14. 

A process safety/protection signal is conducted in on a 
control line 17 to another circuit branch 18. The circuit 
branch 18 has in series a push button switch 19 and a 
solenoid 20 controlling the switch 14. 

Instead of the relays 14, 20 and 15, 16, semiconductor 
elements or similar elements may be used. The coupling 
has been caried out such that possible errors arising in 
the relays coil 20 interconnecting the two circuit branches 
11 and 18, or errors within the process protection system, 
can not prevent emergency shutdown. 

The signal line 12 is conducted to a control valve 21 

operating the actuator 22 of a main valve 23. To drive 

the actuator 22, a hydraulic or pneumatic pressure source 24 

exists. It may have a distributing system having local 

accumulators or a pressiire tank. A return line 25 passes 

as a rule to free air in pneumatic systems, and back to tank 

in hydraulic systems. 
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claims 

1. A control circuit for controlling a combined emergency 
shutdown and process protection (safety) system, particularly 
on platforms, in refinery plants and on board crafts and 
vessels, where there are at least two separate control 
signal generators which, each by means of a control line (10, 
17) of its own, can give release or control signals in order 
to operate a control valve (21) for the supply of hydraulic 
or pneumatic pressure medium, for operating a. main valve (23), 
preferably by means of an actuator (22), wherein either one 
of the two control signal circuits should be operatable 
independently on the operating condition and possible error 
conditions in the other, in order to be capable at emergency 
shut down the main valve (23) , characterized i 
n that it comprises at least two separate connection 
branches (11, 18) for connecting a first and a second control 
cable (10, 17) to a common control line (12) to the control 
valve (21) , and that the other (18) of the two separate 
connection branches (11, 18) includes an activating member 
(20), such as a relay, for a switch (14) adapted to connect 
the first connection branch (11) to the outgoing control line 
(12) , so that an input signal on the first connection branch 
is coupled as an output signal to the control line (12) when 
a voltage is applied to the activating member (20). 

2. A control circuit as set forth in claim 1, 
characterized in that the first connection 
branch (11) includes a switch (15) adapted to be opened when 
an emergency shutdown is being made. 

3. A control circuit as set forth in claim 2, 
characterized in that the switch (15) is 
operated by means of a relay or the like (16) coupled to 
the first connection branch (11) - 

4. A control circuit as set forth in claim 3, 
characterized in that the switch (15) in the 
first connection branch (11) is connected in parallel to 
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a push button switch (13) for restoring the connecting 
condition after an emergency disconnection. 

5, A control circuit as set forth in one of the claims 
1-4, characterized in that the control 
valve (21) , as known per se, has spring-return for transfer 
to emergency stop position. 

6. A control circuit as set forth in one or the claims 
1-5, characterized in that the other 
(second) connection branch has included a manual switch 

(19) for opening current supply to the activating member 

(20) , which gives current supply through the other 
connection branch. 
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